From owner-freebsd-security@FreeBSD.ORG Wed Dec 24 01:00:54 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id F0DA316A4CE for ; Wed, 24 Dec 2003 01:00:54 -0800 (PST) Received: from nanguo.chalmers.com.au (220-244-9-90-qld.tpgi.com.au [220.244.9.90]) by mx1.FreeBSD.org (Postfix) with ESMTP id EC18443D1D for ; Wed, 24 Dec 2003 01:00:50 -0800 (PST) (envelope-from robert@chalmers.com.au) Received: from carbon (carbon.chalmers.com.au [203.1.96.26]) hBO8pKJ1000383 for ; Wed, 24 Dec 2003 18:52:36 +1000 (EST) Message-ID: <000001c3c9fb$47129400$1a6001cb@chalmers.com.au> From: "Robert Chalmers" To: "security" References: <004301c3c9d3$b0219860$1a6001cb@chalmers.com.au> <103305460579.20031223222411@vkt.lt> Date: Wed, 24 Dec 2003 16:38:09 +1000 Organization: The Mission of Our Lady of Fatima MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1158 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.1 Subject: Re: address specified as 1.2.3.4/24{128,35-55,89} Is this Correct???? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Robert Chalmers List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Dec 2003 09:00:55 -0000 Hi, sorry,. that must have been just word wrap 203.1.96.0/24{6-25,27-154,156-199,204-254} in via ${oif} It is actatually one line, no spaces or gaps. ${fwcmd} add deny log all from any to = 203.1.96.0/24{6-25,27-154,156-199,204-254} in via ${oif} this command kills the whole thing ? strange. Robert ----- Original Message -----=20 From: hugle=20 To: Robert Chalmers ; security=20 Sent: Wednesday, December 24, 2003 4:24 PM Subject: Re: address specified as 1.2.3.4/24{128,35-55,89} Is this = Correct???? RC> The man page gives this example, however, when I attempt to use = it, it seems RC> to block the whole set? RC> Could someone tell me what's going wrong here please. Thanks = heaps.. RC> This works, RC> ${fwcmd} add deny log all from any to 203.1.96.1 in via = ${oif} RC> This blocks the whole IP block, not just the list? RC> ${fwcmd} add deny log all from any to RC> 203.1.96.0/24{2,6-25,27-154,156-19 9,204-254} in via ${oif} maybe "156-19 9" ? You have a space ( " " ) in here, so try out: ${fwcmd} add deny log all from any to = 203.1.96.0/24{2,6-25,27-154,156-199,204-254} in via ${oif} RC> the man page bit... RC> list: {num | num-num}[,list] RC> Matches all addresses with base address addr = (specified as a RC> dot- RC> ted quad or a hostname) and whose last byte is in the = list RC> between braces { } . Note that there must be no = spaces between RC> braces and numbers (spaces after commas are allowed). = Elements RC> of the list can be specified as single entries or = ranges. The RC> masklen field is used to limit the size of the set of RC> addresses, RC> and can have any value between 24 and 32. If not = specified, it RC> will be assumed as 24. RC> This format is particularly useful to handle sparse = address RC> sets RC> within a single rule. Because the matching occurs = using a bit- RC> mask, it takes constant time and dramatically reduces = the com- RC> plexity of rulesets. RC> As an example, an address specified as = 1.2.3.4/24{128,35-55,89} RC> will match the following IP addresses: RC> 1.2.3.128, 1.2.3.35 to 1.2.3.55, 1.2.3.89 . RC> Thanks RC> Robert RC> _______________________________________________ RC> freebsd-security@freebsd.org mailing list RC> http://lists.freebsd.org/mailman/listinfo/freebsd-security RC> To unsubscribe, send any mail to RC> "freebsd-security-unsubscribe@freebsd.org" _______________________________________________ freebsd-security@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to = "freebsd-security-unsubscribe@freebsd.org"